In this demonstration, we'll start with the Active Directory Recycle Bin,
and then we'll take a look at Directory Services Restore Mode,
Restartable AD DS, and troubleshooting replication.
To begin with, let me open up dsa.msc.
That's a shortcut to Active Directory users and computers.
Why?
Because I wanted to verify that we do indeed have 2
domain controllers in my domain timw.info,
DC1 and MEM.
Now, notice, they're in the same Active Directory site,
so this assumes that our TCP/IP topology is such that these machines
have persistent high speed inter connectivity.
Now that's another whole architectural question,
but it overlaps with replication troubleshooting,
doesn't it?
Because when you're within a single domain,
those domain controllers assume that they can
communicate with each other at will,
and the way that you can put controls on that is to align the physical TCP/IP
topology of your environment to these Active Directory sites.
And then if you have more than one site,
you can configure bridgehead servers and schedule replication
rather than just let it happen when it needs to.
Again, that's less of a problem nowadays given the ubiquity,
or near ubiquity, of high speed LAN connectivity.
Now, as I promised,
I'm going to demo the Active Directory Recycle Bin using the
Active Directory Administrative Center console.
And what I've done, simply opened the tool,
navigated to my Domain node, and then over here,
we've got the one‑time operation to enable the Recycle Bin,
so let me click that.
We sure we want to do that?
Yes.
Please refresh AD Administrative Center.
Now, AD DS has begun enabling Recycle Bin for the forest.
It's not going to function reliably until all of our
DCs have successfully replicated.
That's a good point to consider.
So let's refresh our view.
And I don't know if you saw that happen,
but we now have a new container in ADAC.
Now, the reason,
another reason, actually, why I opened Active Directory Users and Computers
is that even when you're in the Advanced Features view,
you don't see that Deleted Items container. So it's really
important, not only for your AZ‑801 exam success,
but just in life and industry to know that this is one of those
cases where there is a specific tool for the job.
Now, at this point, there should be nothing in Deleted
Objects because I haven't deleted anything yet.
But I'm going to change that right now.
Let's take a look here at my Users list and see if I can find one.
I've got this Taylor Admin person.
I'm going to right‑click. I'm going to delete that user.
Boom. Potentially catastrophic, right? Well,
not so fast.
We can, as long as we're within our tombstone lifetime,
we can see that account show up under Deleted Objects, and we
can restore to the object's original location, or we can restore
to a custom location here instead.
Maybe I want to restore Taylor to the Staff organizational
unit rather than the Users container.
Now that may very well have implications with Group Policy.
We want to consider that as well.
Nice. Pretty easy, huh?
Now, let's take a look at things like Restartable AD DS and
the question of authoritative restore.
I'm not actually going to demo an authoritative restore because it's
not necessary now that we have the Recycle Bin, and even offline
compaction of the AD database isn't particularly relevant anymore
given that we have restartable AD DS. So let me open up MSConfig.
Actually, let's do the restartable first. I want to do things in
ascending order of impact.
I'm hoping not to have to reboot this DC, but you know I'm going to
have to. Let me open up an elevated PowerShell console, and let me
quickly go into properties and adjust to the font so we can see what
we're doing a little bit better here.
Now, as I showed you, you can use the old net command to stop,
not only Active Directory Domain Services,
but those other dependent services that I mentioned before. Now notice
that the default answer to the confirmation prompt is No, but I'm going to override that with Yes.